CVE-2026-94382

Executive Summary

CVE-2026-94382 is an insecure direct object reference (IDOR) vulnerability (CWE-639) in Beszel, a lightweight server-monitoring platform, affecting all versions prior to 0.19.0. The flaw resides in the POST and DELETE /api/beszel/user-alerts handlers, where the application fails to enforce object-level authorization, allowing any authenticated low-privileged user to create or delete alert rules referencing arbitrary system IDs they cannot legitimately access. Successful abuse results in unauthorized alert registration that leaks target system names and metrics to the attacker via notification channels, with a secondary integrity impact from the ability to delete existing alerts.

Technical Analysis

The vulnerability is a classic horizontal privilege-escalation IDOR mapped to CWE-639 ("Authorization Bypass Through User-Controlled Key"). Beszel is a multi-user monitoring system in which distinct users are expected to have access to distinct sets of monitored systems. The affected endpoints are the alert-management handlers exposed at the API paths POST /api/beszel/user-alerts and DELETE /api/beszel/user-alerts.

The root cause is a missing or inadequate object-ownership check. When a client submits a request to create an alert (POST) or remove an alert (DELETE), the server accepts a system identifier supplied in the request body. Rather than validating that the authenticated principal owns, or is authorized to view, the referenced system, the backend processes the request against the supplied identifier directly. This is the defining property of an IDOR: the authorization decision is based on a user-controlled key rather than on a server-side check binding the object to the requesting identity.

Two distinct impacts flow from this single weakness. First, on the POST path, an attacker can register an alert rule against any system ID. Because alerts generate notifications that include contextual data, the attacker subsequently receives notifications containing the target system's name and metrics — a confidentiality leak (CVSS C:L) that exposes the existence and operational telemetry of systems outside their authorized scope. Second, on the DELETE path, the attacker can remove alert rules belonging to other users or systems, a denial-of-monitoring / integrity impact (CVSS I:L) that can silently suppress legitimate alerting for monitored infrastructure.

The attack surface is the authenticated REST API. No authentication bypass is required; exploitation merely requires any valid low-privileged account, which is why the CVSS vector reflects PR:L (Low privileges required). The AC:H (High attack complexity) rating reflects that the attacker must know or enumerate the target system IDs to supply them in the request body, and that the notification-based disclosure may require additional steps or observation to convert into usable intelligence. UI:N confirms no user interaction is needed and S:U confirms the impact scope remains the vulnerable component. Exploitation is network-accessible (AV:N), giving a base score of 4.2 (Medium). At the time of writing, no public Proof-of-Concept code and no Nuclei template have been observed, and the EPSS score has not yet been published by FIRST.org.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (IDOR / CWE-639) and the endpoint behavior explicitly described in the NVD entry. Only the identifiers named in the source data — the POST and DELETE /api/beszel/user-alerts handlers and the "system IDs" request-body parameter — are used; no additional internal names are asserted.

1. Reconnaissance / target identification. The attacker obtains a valid, low-privileged account on the Beszel instance — feasible in shared or multi-tenant deployments, or via a compromised legitimate user. The attacker then identifies the REST API endpoints POST /api/beszel/user-alerts and DELETE /api/beszel/user-alerts and determines the request-body schema for the "system ID" field, either through API documentation, traffic inspection of their own authorized requests, or simple parameter probing. Because the endpoint is a REST handler, system IDs may be predictable sequential identifiers, easing enumeration.

2. Triggering the flaw class. The attacker issues a request to POST /api/beszel/user-alerts while supplying a system ID that belongs to a system they cannot access. The handler processes the request without verifying ownership of that system ID — the core IDOR condition. No server-side object-level authorization check rejects the mismatched principal/object pairing.

3. Payload/execution method. At the vulnerability-class level, the "payload" is simply a crafted request body containing a foreign system ID directed at the alert-creation endpoint. Because the missing check is an authorization gap rather than a memory-safety or injection flaw, the attacker needs no shellcode, no payload obfuscation, and no memory grooming — only a well-formed authenticated API call. The parallel DELETE operation is executed by issuing a remove request referencing a system ID or alert object the attacker does not own.

4. Post-exploitation impact. Once the alert rule is registered against a foreign system ID, Beszel generates notifications to the attacker's configured delivery channel. These notifications embed the target system's name and metrics, disclosing (a) the existence and identity of systems the attacker should not see and (b) operational telemetry such as resource usage. On the destructive side, the attacker can call the DELETE handler to remove legitimately configured alerts, causing those systems to lose monitoring coverage and creating a blind spot that can mask subsequent malicious activity. Both effects persist until the rogue rule is removed or the legitimate rule restored.

Impact Assessment

Business impact is primarily information disclosure with a secondary integrity/availability-of-monitoring effect. The confidentiality impact (CVSS C:L) stems from notifications that leak system names and metrics across authorization boundaries, enabling an attacker to map an organization's monitored estate and infer operational conditions without ever being granted access to those systems. The integrity impact (CVSS I:L) stems from the ability to delete alert rules, degrading the reliability of monitoring and potentially suppressing detection of real incidents. There is no direct availability impact to the monitored hosts themselves (A:N), and the vulnerable component scope is unchanged (S:U), consistent with the CVSS 3.1 base score of 4.2 (Medium).

The blast radius is limited to the affected Beszel instance and the systems it monitors. In a shared or multi-tenant Beszel deployment, a single low-privileged account can enumerate and act upon other tenants' system IDs, effectively crossing tenant boundaries. Because exploitation requires only Low privileges and no user interaction, any authenticated user is a viable insider or compromised-credential threat actor. The Medium severity reflects that the flaw does not yield code execution or direct data-plane compromise, but the cross-boundary telemetry disclosure and alert-suppression capability are meaningful for environments where Beszel is the primary monitoring control.

Detection Guidance

Sigma Rule

title: Potential Beszel IDOR Alert Manipulation via user-alerts API
id: 7c2a9e14-3b6d-4f0a-9c21-beszel94382
status: experimental
description: Detects POST/DELETE requests to the Beszel user-alerts API that may indicate CVE-2026-94382 IDOR exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94382
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: beszel
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'DELETE'
  selection_uri:
    cs-uri-stem|endswith: '/api/beszel/user-alerts'
  condition: selection_method and selection_uri
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-method
level: medium
tags:
  - attack.t1190
  - cve.2026.94382

YARA Rule

rule CVE_2026_94382_Beszel_IDOR_Alert_Requests
{
    meta:
        description = "Detects HTTP request artifacts targeting the Beszel user-alerts API associated with CVE-2026-94382"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94382"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $e1 = "/api/beszel/user-alerts" ascii wide nocase
        $m1 = "POST /api/beszel/user-alerts" ascii wide nocase
        $m2 = "DELETE /api/beszel/user-alerts" ascii wide nocase

    condition:
        uint16(0) == 0x4854 or $e1 or $m1 or $m2
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94382 Beszel IDOR - user-alerts API manipulation attempt"; flow:established,to_server; http.method; content:"POST"; http.method; content:"DELETE"; http.uri; content:"/api/beszel/user-alerts"; nocase; threshold: type both, track by_src, count 10, seconds 60; classtype:attempted-user; reference:cve,2026-94382; sid:202694382; rev:1;)

Elastic Detection

network where network.protocol == "http" and
  url.path == "/api/beszel/user-alerts" and
  http.request.method in ("POST", "DELETE")

Splunk SPL Query

index=web OR index=proxy (cs_uri_stem="/api/beszel/user-alerts" OR url="/api/beszel/user-alerts") (cs_method=POST OR cs_method=DELETE OR http_method=POST OR http_method=DELETE)
| stats count values(cs_method) as methods values(src_ip) as source_ips by cs_username, cs_uri_stem
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="beszel,web,idor,">
  <rule id="2026943" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\/api\/beszel\/user-alerts</field>
    <field name="method">POST|DELETE</field>
    <description>CVE-2026-94382: Possible Beszel IDOR exploitation - user-alerts API accessed with POST/DELETE.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_94382,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict network access to the Beszel API so that only trusted administrative networks or VPN ranges can reach the POST and DELETE /api/beszel/user-alerts handlers. Enforce strict least-privilege on Beszel accounts: ensure no unnecessary low-privileged or shared accounts exist, and audit account inventory for stale or over-provisioned users. Where possible, place Beszel behind a reverse proxy or WAF with rules that flag requests to the user-alerts endpoints and apply rate limiting. As an interim compensating control, monitor notifications and audit logs for alert rules registered against unexpected or foreign system IDs, and alert on DELETE operations against alerts not owned by the requesting account. Because no vendor fix is confirmed from tracked sources, treat any Beszel version below 0.19.0 as vulnerable by default and do not rely on configuration alone for full protection.

2. Patch/upgrade steps. Upgrade Beszel to version 0.19.0 or later, which the NVD description identifies as the first version in which the flaw is remediated. Validate the upgrade by confirming the platform no longer registers or deletes alerts for system IDs the authenticated user does not own. Where the deployment is container-based or managed via package manifests, update pinned image tags or version constraints and redeploy affected instances. Given the 0/4 patch confidence, independently verify the fixed version against the vendor's release channel before closing remediation tickets.

3. Long-term hardening. Adopt a defense-in-depth posture for object-level authorization: require server-side ownership checks binding every object identifier to the requesting principal, and add automated authorization tests to CI for all state-changing API handlers. Apply consistent, per-user or per-tenant scoping of system IDs and avoid predictable sequential identifiers where feasible. Enable comprehensive API audit logging with correlation of actor identity to object identifier, and continuously monitor for anomalous create/delete patterns on alert-management endpoints. Establish a vulnerability management cadence that tracks Beszel releases and re-evaluates compensating controls when updates land.

References

• NVD — CVE-2026-94382: https://nvd.nist.gov/vuln/detail/CVE-2026-94382
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Beszel project repository (release history / 0.19.0): https://github.com/henrygd/beszel
• CISA Known Exploited Vulnerabilities Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public Proof-of-Concept code, Nuclei template, or exploit code has been observed for CVE-2026-94382, and the vulnerability is not present in the CISA KEV catalog. No threat actor campaigns or in-the-wild exploitation evidence were identified in the available data at the time of writing.